Quick answer

If an online lending app is harassing you, publicly shaming you, misusing your photos or personal information, or using your phone contacts to collect a debt, you can report the conduct to more than one government agency. Privacy violations belong primarily with the National Privacy Commission (NPC); unfair collection practices by lending and financing companies may be reported to the Securities and Exchange Commission (SEC); and threats, fraud, scams, or potentially criminal cyber conduct may also be reported to the PNP Anti-Cybercrime Group (PNP ACG), NBI Cybercrime Division, or DICT Cyber Hotline.

A March 18, 2026 joint advisory of the DICT, NPC, and SEC expressly states that unnecessary, unauthorized, excessive, or disproportionate processing of borrowers' personal data is prohibited. It specifically prohibits using contact-list data to harass borrowers or collect debts from people other than the borrower's guarantors. For debt collection, a lender or financing company may contact a person from the borrower's contact list only if that person is actually a guarantor. (National Privacy Commission)

For an NPC complaint, there is an important procedural step: as a general rule, you should first notify the lender or other respondent in writing about the privacy violation and give it an opportunity to act. If it fails to take timely or appropriate action, or does not respond within 15 calendar days from receipt of your written notice, you may proceed with the formal NPC complaint. The NPC may waive this requirement for good cause or serious violations, including circumstances involving grave and irreparable harm or patently illegal conduct.

Do not delete the messages, uninstall the app, or erase your account before preserving your evidence.

What online lending practices can violate privacy or collection rules?

Owing money does not give a lender unlimited authority over your personal information. The Data Privacy Act requires processing to have a lawful basis and to comply with transparency, legitimate purpose, and proportionality. Personal information must be relevant and not excessive for the stated purpose. (Lawphil)

The current government guidance specifically identifies conduct such as harassment arising from excessive personal-data processing, using contact lists to collect from persons other than guarantors, threatening violence or other criminal means against a person's body, reputation, or property, and threatening action that cannot legally be taken. These rules apply to entities offering or facilitating loans through online lending platforms whether the platform is recorded or unrecorded. (National Privacy Commission)

A lender's app also cannot demand unnecessary permissions merely because the borrower clicked "allow." NPC rules require app permissions to be suitable, necessary, and not excessive for the declared purpose. Camera or photo-gallery access, for example, may be justified for a legitimate step such as identity verification, KYC, fraud prevention, or payment verification, but the permission should not remain available indefinitely when its purpose has already been fulfilled. Borrower photographs cannot lawfully be processed as tools for harassment or embarrassment in debt collection. (National Privacy Commission)

Consent is therefore not a blanket authorization to do anything with a borrower's data. The 2026 joint advisory also warns against deceptive interfaces such as pre-ticked permission boxes, interfaces that make consent easy to give but difficult to withdraw, or designs that obscure the privacy-preserving choice. Such practices may undermine valid consent.

Your phone contacts are especially protected

NPC rules make an important distinction between a character reference and a guarantor.

A character reference is provided for purposes such as verifying the borrower's identity or the truthfulness of information supplied in the loan application. The lender may inform that person that he or she was selected as a reference, but a character reference does not automatically become responsible for the debt. Contacting a character reference for debt collection merely because the person's number appears in the borrower's phone is not allowed. (National Privacy Commission)

A guarantor, by contrast, is someone who has expressly agreed to assume responsibility in accordance with the law on guaranty. NPC rules require separate consent before a person is treated as a guarantor. For debt-collection purposes, the current rule is direct: lenders, financing companies, and persons acting for them may contact the guarantor, but contacting other persons in the borrower's contact list for debt collection is prohibited. (National Privacy Commission)

This means that a lender cannot justify messaging your coworkers, relatives, friends, clients, or other saved contacts about your debt simply by saying that you once gave the app access to your contacts.

Preserve evidence before blocking, deleting, or uninstalling anything

Build your evidence file before changing the app or phone. Useful evidence includes:

Screenshots of texts, chats, social-media messages, collection notices, posts, and threats, preferably showing the sender, account or number, date, and time.
Call logs and voicemails, plus recordings that you already lawfully possess.
Screenshots sent to you by relatives, coworkers, friends, or other third parties whom the collector contacted.
The app's name, app-store page, developer or publisher, website, privacy notice, permissions requested, and the name of the lending or financing company behind it.
Your loan agreement, disclosure statement, promissory note, payment schedule, receipts, payment history, and account or loan number.
The names and contact details of persons you actually designated as character references or guarantors, if any.
Evidence showing that a contacted person was not your guarantor.
Copies of any photographs or personal information the collector distributed or posted.
Your written complaint or privacy request sent to the lender, together with proof of delivery and any response.
A simple chronology identifying what happened, when it happened, who did it, what information was disclosed, and to whom.

Where possible, retain the original electronic files rather than relying only on cropped screenshots. Ask affected contacts to preserve their own copies of messages and call records as well.

Step 1: Identify the company behind the app

Do not assume that the app's brand name is the legal name of the lender. Check the loan agreement, disclosure statement, privacy notice, app-store developer information, payment instructions, collection messages, and SEC records for the corporate entity operating the platform.

The SEC states that lending activity must be conducted by a corporation properly registered and authorized to engage in lending. The SEC also maintains information on lending companies, financing companies, and recorded online lending platforms. Government guidance recommends checking whether the operator is duly registered and licensed. (Securities and Exchange Commission)

If the company cannot be identified, preserve everything that may help regulators trace it: app name, developer, website domains, telephone numbers, email addresses, payment accounts, e-wallet numbers, bank details, social-media accounts, advertisements, and app-store links. The fact that an OLP is unrecorded does not place its personal-data processing outside the rules reiterated in the 2026 joint advisory. (National Privacy Commission)

Step 2: Send a written privacy complaint to the lender

Before filing an ordinary NPC complaint, send the company a written notice describing the privacy violation. Address it to the company's Data Protection Officer, privacy contact, consumer assistance unit, or other official complaint channel where available.

State the dates and conduct complained of, identify the personal data involved, name the persons who received your information if known, and request appropriate corrective action. Depending on the circumstances, you may request that the company stop contacting non-guarantors, stop unauthorized or excessive processing, identify what personal data it holds and where it obtained the data, disclose recipients of your data, correct inaccurate information, and block, remove, or destroy information that is unlawfully obtained, being used for unauthorized purposes, or no longer necessary.

These requests reflect rights expressly recognized by Section 16 of the Data Privacy Act, including rights to information, access, correction, blocking or removal in qualifying circumstances, and indemnification for damage caused by certain unlawful uses of personal information. (Lawphil)

Keep proof showing when the company received your notice. Under the NPC's Rules of Procedure, the usual 15-calendar-day period runs from the respondent's receipt of the written notice, not merely from the date you drafted or sent it.

Step 3: File the privacy complaint with the National Privacy Commission

File with the NPC when the complaint concerns matters such as unlawful access to contacts, disclosure of personal information, misuse of photographs, excessive app permissions, unauthorized processing, or use of personal data to harass or shame the borrower.

The NPC's current filing procedure calls for a notarized Complaints-Assisted Form or Complaint-Affidavit, supporting evidence, and the applicable Service Request and Assessment Form. The NPC permits filing through its prescribed channels, including personal submission and electronic submission. Its current Citizen's Charter identifies complaints@privacy.gov.ph for complaint submissions. (National Privacy Commission)

Use the current form from the NPC website rather than an old copy saved elsewhere. The NPC introduced a new Complaint-Affidavit template effective July 1, 2025 and announced that the previous version would cease to be accepted after the transition period. (National Privacy Commission)

The complaint should clearly identify the complainant and respondent, narrate the material facts, identify the Data Privacy Act or privacy-related conduct complained of as accurately as possible, attach the supporting documents and witness affidavits available, state the relief requested, and include the required certification against forum shopping. The NPC Rules specifically require the complainant to attach correspondence with the respondent showing compliance with the prior-notice requirement.

NPC filing fees

NPC complaints are no longer automatically free. NPC Circular No. 2023-01 sets the basic filing fee for a complaint at ₱500, with a legal-research fee of 1% of the filing fee but not less than ₱10. Additional fees apply when damages are claimed. The NPC's 2025 Citizen's Charter continues to state that filing fees are required under that circular.

Qualifying indigent litigants are exempt from legal fees under the current fee schedule if the gross income of the litigant and immediate family does not exceed double the monthly minimum wage and the litigant does not own real property with a fair market value exceeding ₱300,000, subject to the required supporting documents.

Because fees and payment procedures can be administratively updated, obtain the current assessment from the NPC rather than sending an assumed amount.

What if you cannot wait 15 days?

The 15-day requirement is the general exhaustion rule for an NPC complaint; it is not a rule requiring someone facing a serious threat to remain exposed to danger.

The NPC may waive some or all of the prior-notice requirements for good cause or where the allegations involve a serious Data Privacy Act violation or breach. Its rules identify circumstances including grave and irreparable damage that only NPC action can prevent or mitigate, the absence of a plain, speedy, or adequate remedy from the respondent, or conduct that is patently illegal. If you rely on an exception, explain and support the urgency in the complaint rather than simply omitting the prerequisite.

For continuing serious misuse of personal information, the NPC's rules also provide formal mechanisms such as an application for a temporary ban on processing. Such relief is not automatic and has procedural and bond requirements, so urgent cases may warrant legal assistance. (National Privacy Commission)

Step 4: Report unfair collection practices to the SEC

If the conduct involves a lending company, financing company, or its collectors, file a separate regulatory complaint with the SEC when appropriate.

The March 2026 DICT-NPC-SEC advisory specifically directs reports of unfair debt collection practices to the SEC Financing and Lending Companies Department and identifies the SEC iMessage system as a complaint channel.

The SEC's complaint guidance requires a properly accomplished complaint form, supporting evidence, a valid government-issued ID, and one complaint form per respondent company. The SEC may furnish the complaint to the company for an answer or comment; its current complaint page states that the company is given 10 days from receipt to submit that answer or comment. (SEC Appointment System)

The Financial Products and Services Consumer Protection Act also recognizes financial consumers' rights to fair treatment, data privacy and protection, and timely complaint handling. It expressly prohibits financial service providers from employing abusive collection or debt-recovery practices and makes providers responsible for certain conduct of their representatives and accredited third-party service providers. (Lawphil)

A complaint does not automatically erase the debt

Separate the loan obligation from the method used to collect it.

A borrower may have a valid unpaid obligation while the lender is simultaneously violating privacy or collection rules. Reporting unlawful collection does not, by itself, cancel a valid loan, change the agreed payment schedule, or make the contract disappear.

The SEC expressly states that in its lending-company complaint process it cannot simply change the loan's terms, declare the loan contract void, or cancel or settle the borrower's obligation. (SEC Appointment System)

Conversely, an unpaid balance does not authorize harassment, public shaming, excessive personal-data processing, or collection through non-guarantor contacts.

Step 5: Report threats, fraud, scams, or other potentially criminal conduct

Do not treat serious threats merely as a customer-service issue. The March 2026 government advisory identifies the NBI Cybercrime Division, PNP Anti-Cybercrime Group, and DICT Cyber Hotline as channels for other forms of harassment, threats, fraud, and scams involving online lending platforms.

The NBI's current Citizen's Charter confirms that members of the public may proceed to its Cybercrime Division to file a complaint or request an investigation. The process can include a preliminary interview, sworn statements from the complainant and witnesses, submission of supporting documents, and examination of a relevant device. The NBI states that no fee is charged for this investigative-assistance process. (National Bureau of Investigation)

If there is a credible threat of physical violence or another immediate safety risk, contact law enforcement promptly. You do not have to complete an NPC administrative complaint before seeking police assistance for an urgent threat.

What penalties can apply?

The consequences depend on what the evidence proves and which law was actually violated. The 2026 joint advisory states that violations of applicable laws, implementing rules, and SEC regulations can expose erring financing and lending companies to administrative sanctions including fines, suspension, or revocation of authority to operate.

The Data Privacy Act separately creates criminal offenses for specified conduct. For example, unauthorized processing of ordinary personal information under Section 25 carries imprisonment of one to three years and a fine of ₱500,000 to ₱2 million; unauthorized processing of sensitive personal information carries three to six years and ₱500,000 to ₱4 million. The Act also contains separate offenses for processing for unauthorized purposes, malicious disclosure, and unauthorized disclosure. Whether any particular collector, employee, officer, company, or other person is criminally liable requires proof of the elements of the specific offense and is ultimately a matter for the proper authorities and courts. (Lawphil)

A privacy complaint therefore should describe what actually happened rather than simply alleging every possible crime.

Common mistakes that can weaken a complaint

Deleting the evidence too early. Blocking numbers and uninstalling an app may be sensible eventually, but preserve messages, permissions, account details, and app information first.

Naming only the app instead of the legal entity. Regulators need to identify the respondent. Give both the brand or app name and the corporate operator whenever possible.

Filing an ordinary NPC complaint without first notifying the respondent. Unless you can properly invoke an exception, the written-notice and 15-day requirement matters.

Assuming every character reference is a guarantor. It is the opposite: a character reference does not automatically become a guarantor. Separate consent to guaranty is required. (National Privacy Commission)

Submitting hundreds of screenshots without explaining them. Organize the material chronologically and identify the sender, recipient, date, conduct complained of, and significance of each important exhibit.

Assuming an app permission defeats your privacy complaint. Permission does not automatically make unnecessary, excessive, disproportionate, or harassing processing lawful. (National Privacy Commission)

Assuming the complaint cancels the loan. Challenge the abusive conduct separately from any legitimate dispute over the amount or enforceability of the obligation.

When legal help is urgent

Consider prompt legal assistance when the collector is threatening violence, publishing or threatening to publish highly sensitive information or intimate material, impersonating government or law-enforcement personnel, contacting an unusually large number of people, using stolen identities or accounts, repeatedly evading blocks through different numbers, or causing continuing serious reputational or economic harm.

Legal assistance may also be useful where you need urgent NPC relief, intend to claim substantial damages, cannot identify the entity behind the app, several companies or collection agencies are involved, or parallel civil, criminal, SEC, and NPC proceedings may be appropriate.

FAQ

Can an online lending app message everyone in my contacts if I fail to pay?

No. Current NPC rules and the 2026 DICT-NPC-SEC advisory prohibit contacting persons in the borrower's contact list for debt collection unless those persons were named as guarantors. (National Privacy Commission)

What if I gave the app permission to access my contacts?

That does not authorize unlimited use of the information. Processing must still have a lawful basis and comply with necessity, proportionality, and the specific NPC rules governing loan-related transactions. Unbridled contact-list processing and processing that leads to harassment remain prohibited. (Lawphil)

Can the lender call my character reference about my unpaid loan?

A character reference is not automatically a guarantor. Character-reference information is for permitted verification purposes; debt collection may be directed to a guarantor who separately and expressly consented to that status. (National Privacy Commission)

Where should I report contact-list harassment?

For the personal-data misuse, file with the National Privacy Commission. For unfair collection by a lending or financing company, a parallel SEC complaint may be appropriate. If the conduct includes threats, fraud, scams, or other potentially criminal cyber activity, consider the PNP ACG, NBI Cybercrime Division, or DICT Cyber Hotline as well.

Must I wait 15 days before going to the NPC?

Ordinarily, you must first notify the respondent in writing and either receive an inadequate response or wait until there has been no response within 15 calendar days after receipt. The NPC may waive this exhaustion requirement for good cause or serious violations under the circumstances specified in its Rules of Procedure.

Can I file against an unregistered or unrecorded lending app?

Potentially, yes. The March 2026 joint advisory expressly reiterates the privacy rules for entities offering or facilitating loans through OLPs whether recorded or unrecorded. Identification of the actual respondent may nevertheless become a practical evidentiary issue, so preserve every detail that could identify the operator. (National Privacy Commission)

Can the NPC order deletion of my data or award damages?

The Data Privacy Act recognizes rights that can include blocking, removal, or destruction of personal information when the statutory conditions are established, and the NPC has authority to receive and adjudicate complaints and award indemnity in matters affecting personal information. The precise relief depends on the allegations, evidence, applicable exceptions, and NPC findings. (Lawphil)

Should I stop paying the loan because I filed a harassment complaint?

Not on that fact alone. A privacy or unfair-collection complaint does not automatically extinguish an otherwise valid debt. Continue to assess the underlying loan obligation separately and obtain legal advice if you dispute the amount, interest, validity, or enforceability of the loan. (SEC Appointment System)

Official sources

For the current rules and filing procedures, consult the DICT-NPC-SEC Joint Advisory on Online Lending Platforms dated March 18, 2026; NPC Circular No. 2022-02 on personal data in loan-related transactions; Republic Act No. 10173, the Data Privacy Act of 2012; NPC formal complaint filing page; NPC website for current complaint forms and announcements; SEC complaint guidance for lending and financing companies; Republic Act No. 11765, the Financial Products and Services Consumer Protection Act; and the NBI Cybercrime Division investigative-assistance procedure.

General-information disclaimer

This article provides general Philippine legal information and is not a substitute for legal advice on a particular loan, privacy incident, threat, or pending case. The correct remedy can depend on the identity and regulatory status of the lender, the precise information processed or disclosed, how consent was obtained, who was contacted, the content of collection messages, and the available evidence. Law and official procedures checked as of August 26, 2026.